CVE-2026-32175: Microsoft .NET Core path traversal tampering vulnerability

CVE-2026-32175 · Severity: high · CVSS 7.5 · Published 2026-05-12

A security flaw in Microsoft .NET and Visual Studio could allow an attacker to tamper with files on a system. By sending a specially crafted file to an application using these tools, an attacker could write unauthorized files or directories to certain locations. While the attacker has limited control over where these files are placed, this could still disrupt operations or be used as a stepping stone for further system tampering.

Technologies: Microsoft .NET Core, Microsoft .NET Core Runtime, Microsoft Visual Studio 2022, Microsoft.NetCore.App.Runtime.win-arm (NuGet), Microsoft.NetCore.App.Runtime.win-arm64 (NuGet), Microsoft.NetCore.App.Runtime.win-x64 (NuGet), Microsoft.NetCore.App.Runtime.win-x86 (NuGet). Vendors: Microsoft, NuGet.

Quick answers

Is CVE-2026-32175 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-32175 being exploited in the wild.
How severe is CVE-2026-32175?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
Microsoft .NET Core Runtime 8.0.0 - 8.0.26, 9.0.0 - 9.0.15, 10.0.0 - 10.0.7; Microsoft Visual Studio 2022 17.12.0 to 17.12.19, 17.14.0 to 17.14.31; Microsoft.NetCore.App.Runtime.win-arm (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.27; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet) ECOSYSTEM:introduced=8.0.0,fixed=8.0.27; and 2 more.
Is there a fix for CVE-2026-32175?
Yes. Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.27 or later; Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.27 or later; Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.27 or later; Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.27 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32175 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-32175?
Check whether you run Microsoft .NET Core, Microsoft .NET Core Runtime, Microsoft Visual Studio 2022 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Microsoft.NetCore.App.Runtime.win-arm (NuGet): upgrade to 8.0.27 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-arm --version 8.0.27
  • Microsoft.NetCore.App.Runtime.win-arm64 (NuGet): upgrade to 8.0.27 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-arm64 --version 8.0.27
  • Microsoft.NetCore.App.Runtime.win-x64 (NuGet): upgrade to 8.0.27 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x64 --version 8.0.27
  • Microsoft.NetCore.App.Runtime.win-x86 (NuGet): upgrade to 8.0.27 or later
    dotnet add package Microsoft.NetCore.App.Runtime.win-x86 --version 8.0.27

Technical details

This vulnerability is classified as a path traversal issue (CWE-22/CWE-36) within .NET Core and related Visual Studio components. The root cause is improper validation of file paths when handling specially crafted files, which allows an authenticated attacker to write files or directories to unintended locations on the host filesystem. The attack vector is network-based, requiring the attacker to have low-level privileges and the ability to send a malicious file to the vulnerable system. While the attacker can write arbitrary data, they have limited control over the exact destination path. Microsoft has released security updates for .NET 8.0, 9.0, 10.0, and Visual Studio 2022/2026 to address this behavior.

Affected products

  • Microsoft .NET 8.0 8.0.0 to 8.0.26
  • Microsoft .NET 9.0 9.0.0 to 9.0.15
  • Microsoft .NET 10.0 10.0.0 to 10.0.7
  • Microsoft Visual Studio 2022 17.12.0 to 17.12.19, 17.14.0 to 17.14.31
  • Microsoft Visual Studio 2026 18.5.0 to 18.5.2

Identifiers

  • CVE-2026-32175
  • GHSA-rg75-q538-x34v

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.